vidar | 1509904cb8c9fcfd05ed268e9f9bff72b56065c39b208b0b8b905be77f1afb63

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msu.exe
Size 6.7MB
Sample261011-tp941ada69
SHA256 1509904cb8c9fcfd05ed268e9f9bff72b56065c39b208b0b8b905be77f1afb63
MD5 096a6d78d037bc37449d784c98700784
SHA1 ef33a581c52e530dbc2e477ba1ee2d99769fe710
SHA512 e850c9b0807999d0027086c61134e92eebb3fed530f0609d08e17d4c0dabe1aa4d0638eae7a6b346128e7c26f3d62e7e5c5fbf63cf9e2299566bf2435ebd9150
SSDEEP 24576:UUvYhORZk7gH7l2V1JDq3ZW+Y/syDqVCRghiaceDfymYqlYYVb6ink+3nLIz:UbORZXZ03DqpfY/syDqagEqlfTnEz
TLSH
T1E866B85971C410EDCA8E837609F45DBE23B21DBF1613A68A0799BBE52F13BD65F20C48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fc53a5301d9a259bbf2af89c45ee6787 discovery vidar stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

fc53a5301d9a259bbf2af89c45ee6787

https://95.182.97.240
https://telegram.me/scii0n
https://steamcommunity.com/profiles/76561198628246386

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msu.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5736	msu.exe
5736	msu.exe
5736	msu.exe
5736	msu.exe
5736	msu.exe
5736	msu.exe

C:\Users\Admin\AppData\Local\Temp\msu.exe
"C:\Users\Admin\AppData\Local\Temp\msu.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5736-0-0x0000000350000000-0x0000000350298000-memory.dmp

Download

memory/5736-1-0x0000000350000000-0x0000000350298000-memory.dmp

Download

memory/5736-4-0x0000000350000000-0x0000000350298000-memory.dmp

Download